Data Breach Notification Law: Your Rights Under GDPR

In short: Data breach notification law under GDPR requires companies in the EU, EEA and UK to tell their regulator about a serious data breach within 72 hours and to tell affected people directly if the risk to them is high, under GDPR Articles 33 and 34. You also have the right to ask exactly what data of yours was caught up in it, and to claim compensation under Article 82 — and the EU's top court has confirmed that a genuine fear your data will be misused can itself count as compensable harm, even if nothing bad has happened yet, in a 2023 ruling over Bulgaria's tax agency breach.

If a company tells you your data was exposed in a breach, that notice is the start of a legal process, not the end of one. Data breach notification law in Europe comes from the GDPR, which applies across the EU and EEA and continues in modified form as UK GDPR after Brexit. It sets out specific obligations the company has to you and specific things you can demand in return. Below is what each right actually covers, and where it comes from.

What counts as a data breach under GDPR?

The GDPR defines a "personal data breach" broadly: any security failure that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. The consolidated GDPR text on EUR-Lex spells this out directly: a breach is "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed." That covers a hacked database, a lost laptop, an email sent to the wrong person, or a misconfigured server left open online — it does not have to involve a hacker at all.

The same regulation makes the company holding your data — the "controller" — responsible for proving it kept that data secure in the first place. Article 5, in the EUR-Lex text, requires companies to process data securely and puts the burden of proof on the controller to show it complied. That burden matters later if you pursue compensation.

What must a company do after a data breach?

A company's first obligation is to its regulator, not to you. Under GDPR Articles 33 and 34, and detailed in the European Data Protection Board's Guidelines 9/2022 on personal data breach notification, a company must notify its national data protection regulator within 72 hours of becoming aware of a breach, unless the breach is unlikely to put people's rights and freedoms at risk.

Telling you directly is a separate, higher bar. The EDPB guidelines explain that companies only have to notify affected individuals when the breach is likely to cause a "high risk" to their rights and freedoms — not every breach that gets reported to a regulator reaches that threshold. When a company does notify you, the EDPB guidelines say the notice must be in plain language, explain what happened, give you a contact point, describe the likely consequences, and say what the company is doing to fix it and limit the damage.

There are carve-outs. Under the UK's retained version of the GDPR, Article 34 on legislation.gov.uk says a company does not have to contact you individually if the exposed data was already encrypted, if it has since taken steps that mean the high risk "is no longer likely to materialise," or if contacting everyone affected "would involve disproportionate effort" — in which case it must instead make a public statement "in an equally effective manner."

Companies also have to keep records of every breach they experience, including ones they decide are too minor to report, according to the EDPB guidelines. Regulators can demand to see those records to check a company is complying. If a breach crosses borders and affects people in several EU/EEA countries, the company has to notify its lead supervisory authority, and in some cases every national regulator where affected people live. Failing to notify when required can cost a company up to €10 million or 2% of its global annual turnover, per the same guidelines.

If you think you've been affected by a breach but haven't heard anything, it's worth running through our step-by-step checklist of actions to take while you wait to find out more, and to watch out for scams targeting breach victims who try to exploit the confusion.

How do I find out what data was involved in the breach?

You don't have to wait for the company to volunteer details — GDPR gives you a standing right to ask. Article 15, the right of access set out in the consolidated GDPR text, lets you request confirmation of what personal data a company holds on you and how it has been processed, which you can use specifically to find out whether your own records were among those exposed in a given breach. Our guide on how to request your data walks through how to word and send that request.

This matters because a breach notice from a company is often generic — it may say "some customers'" data was affected without confirming whether yours was one of them. A subject access request forces a specific answer.

Do I have a right to compensation after a data breach?

Yes. Article 82 of the GDPR gives anyone who suffers financial loss or non-financial harm from a breach of the regulation a right to compensation from the controller, and the EUR-Lex text of the regulation sets that right out directly. Non-financial harm covers things that aren't a direct monetary loss — distress, for instance — not just damage you can put a number on.

How far that stretches was tested in a landmark case at the EU's top court. The case began with a 2019 cyberattack on Bulgaria's National Revenue Agency that exposed the personal data of more than 6 million people. One affected person sued over non-financial harm based on fear that her data would be misused in future, even though she couldn't point to any actual misuse. In its judgment of 14 December 2023 in Case C-340/21, the Court of Justice of the European Union (CJEU) ruled that fear of possible future misuse of personal data can, by itself, count as non-material damage entitling a person to compensation under Article 82(1) — without needing proof that misuse has actually happened.

That ruling comes with a limit: the claimant still has to show the fear is genuine and well-founded given her specific circumstances, not just a hypothetical worry that something might go wrong. And the court made clear a breach caused by hackers doesn't automatically make the company liable — nor does it let the company off the hook. The ruling says the company must prove it bears no responsibility for the event that caused the damage, and that the mere fact a breach happened doesn't by itself prove its security measures were inadequate. Courts have to assess whether those measures were appropriate in the specific circumstances, and the burden of proving they were appropriate falls on the company, not on you.

In practice, this means: if a company's breach has left you anxious that your data — a national ID number, health information, financial details — could resurface and be misused, that anxiety can be the basis of a compensation claim on its own, provided you can explain concretely why the fear is reasonable in your case, rather than a generalised unease.

Which authority can I complain to if the company fails to notify me?

GDPR gives you the right to lodge a complaint with your national data protection authority if you believe a company has mishandled a breach or failed to notify you when it should have. That right sits within the same regulation that creates the notification and compensation duties described above, in the consolidated GDPR text on EUR-Lex. Each EU/EEA country has its own regulator — Denmark's Datatilsynet, France's CNIL, and others — and the UK has the Information Commissioner's Office (ICO); each publishes its own process for raising a concern, so check your national authority's own complaint page for the exact steps.

Can someone else act on my behalf after a data breach?

Yes, up to a point. Article 80 of the GDPR, in the consolidated text on EUR-Lex, lets you mandate a non-profit body active in data protection to lodge a complaint with a regulator on your behalf and, where national law provides for it, to pursue compensation for you. Wider group or collective claims run on a separate track, through each country's own civil procedure rules, so whether one is available at all depends on where you live and where the company is based. If you're deciding what to do first, our step-by-step checklist of actions to take covers the immediate steps regardless of where any group action stands.